On 2026-10-22T18:38:39, anon87111 <[email protected]> wrote: > image-fit-sig: bind a required image key to its own verification > > fit_image_verify_required_sigs() passes each required key's node offset to > fit_image_verify_sig() as key_offset. That function never uses it: it calls > fit_image_check_sig() with required_keynode hardcoded to -1, which both > boot/image-fit-sig.c and include/image.h document as "any signature will > do". rsa_verify() then tries the key named by the FIT's own key-name-hint > and falls through to "try each of the keys in turn", so every required-key > iteration is satisfied by any signature that verifies under any key in the > control FDT. > > With two or more keys marked required = "image", one signature from any one > of them satisfies the whole policy and the others contribute nothing. > doc/usage/fit/signature.rst says of "required": "this indicates that the > key must be verified for the image / configuration to be considered valid." > > The configuration path is correct: fit_config_verify_key() passes > key_offset through to fit_config_check_sig(). > > On sandbox, with key-dev and key-prod both required = "image" and a FIT > carrying only a dev signature: > > Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev+ OK > sandbox: continuing, as we cannot run Linux > > The doubled "dev+" is one signature satisfying both iterations, including > the one for key-prod. The same case against the configuration gate refuses: > > Verifying Hash Integrity ... sha256,rsa2048:dev+ sha256,rsa2048:dev- error! > Failed to verify required signature 'key-prod' > > Nothing exercises this path: there is no required = "image" anywhere in the > tree, and test_required_key() builds only sign-configs-* fixtures. > > Fixes: 56518e71041f ("image: Support signing of images") > Signed-off-by: anon87111 <[email protected]> > > boot/image-fit-sig.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-)
Reviewed-by: Simon Glass <[email protected]>
